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Information Commissioner's Office 


Freedom of Information Act 2000 (FOIA) 


Decision notice 


Date: 9 October 2012 
Public Authority: London Borough of Barnet 
Address: North London Business Park 


Oakleigh Road 
South London 
N11 1NP 


Decision (including any steps ordered) 


1. The complainant has requested a copy of the One Barnet programme 
risk register. London Borough of Barnet (the “council”) provided a 
redacted version of the requested document and withheld the remaining 
information under the commercial interests and personal data 
exemptions. 


2. The Commissioner’s decision is that the council has wrongly defined the 
scope of the request, that it has correctly withheld the personal 
information of third parties and that it has failed to demonstrate that the 
exemption for commercial interests is engaged. 


3. The Commissioner requires the public authority to take the following 
steps to ensure compliance with the legislation. 


e Provide the complainant with the “issues” elements of the risk 
register or issue a refusal notice; 


e Disclose the information from the risk register that it withheld 
under section 43(2) of the FOIA. 


4. The public authority must take these steps within 35 calendar days of 
the date of this decision notice. Failure to comply may result in the 
Commissioner making written certification of this fact to the High Court 
pursuant to section 54 of the Act and may be dealt with as a contempt 
of court. 
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Background 


5. The council’s website describes the “One Barnet” programme: 


“One Barnet is the overall name for the major change projects running 
across the council. It aims to make sure that the council can continue to 
provide high quality and efficient services over the next 10 to 15 
years...” 


“The One Barnet programme is working to reduce costs, while retaining 
the quality of services, which in many cases means changing the way in 
which that service is delivered. The One Barnet programme seeks the 
best solution for the needs and requirements of the users of each 
service.” 


6. The programme was approved by the council in November 2010 and has 
been the subject of public debate and concern. The focus of these 
concerns has been on the extent to which the programme will rely on 
the outsourcing of public services to private sector partners and the 
value of the contracts involved’. It is within this context that the 
request appears. 


Request and response 


7. On 16 August 2011 , the complainant wrote to the council and requested 
information in the following terms: 


“Please provide a copy of the One Barnet programme risk register...” 


8. The council responded on 12 September 2011 and provided the 
complainant with a link to a report on its website which contains some of 
the major risks extracted from the risk register. 


9. The complainant wrote to the council on 15 September 2011, reiterating 
their original request and asking to be provided with the “entire 
register.” 


1 

http://www. barnet. gov.uk/info/920056/one_barnet_transformation_programme/904/one_b 
arnet_transformation programme 

? See, for example: http://www.times- 
series.co.uk/news/9831768.Hundreds_march_against_One_Barnet/ 
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10. The council responded on 21 September 2011 and stated that it was 


11. 


withholding the information under the exemption for prejudice to 
commercial interests. 


Following an internal review the council wrote to the complainant on 8 
May 2012. It disclosed to the complainant a redacted copy of the risk 
register. The council stated that it considered that some of the redacted 
information fell outside the scope of the request and that the remainder 
was being withheld under the exemptions for personal data and 
prejudice to commercial interests. 


Scope of the case 


12. 


13. 


14. 


The complainant contacted the Commissioner to complain about the way 
his request for information had been handled. 


During the course of the Commissioner’s investigation, the council 
disclosed further information to the complainant which it had previously 
withheld under the commercial interests exemption. 


The Commissioner’s investigation has looked at whether the council 
correctly defined the scope of the request and whether it was entitled to 
rely on exemptions to withhold the remaining requested information. 


Reasons for decision 


Section 1 - scope of the request 


15. 


16. 


17. 


In its internal review response the council explained that, due to a 
technical constraint on the council’s risk management system, the risk 
register report includes project issues as well as risks. It confirmed that 
these project issues had been redacted from the version of the register 
disclosed to the complainant because they did not fall within the scope 
of the request. 


In order to understand why the redacted information had been deemed 
not to fall within the scope of the request, the Commissioner approached 
the council for further explanation. 


The council explained that the risk assessment methodology uses “risks” 
and “issues. Risks are defined as pre-emptive problems that have been 
identified and are being pro-actively managed; issues are actual 
problems that have occurred and which are being managed. 
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Whilst the Commissioner understands the distinction between risks and 
issues, he does not see that this is relevant to a determination of the 
scope of the request. The Commissioner is not satisfied that the 
explanation provided by the council justifies the exclusion of the ‘issues’ 
sections of the risk register from the scope of the request. 


The Commissioner considers that, in making the request, the 
complainant could not have been expected to understand the intricacies 
of the distinction between ‘issues’ and ‘risks’ made by the council. By 
the same token, the Commissioner considers that the council is not 
entitled to speculate about what elements of the risk register the 
complainant was interested in receiving. He finds that an objective 
reading of the request, which explicitly asks for a copy of the “entire 
register” does not allow for a distinction to be drawn between the 
different elements of the register as the council has defined them. 


The Commissioner has determined that the council has wrongly 
interpreted the scope of the request. He requires the council to either 
provide the complainant with the “issues” sections of the risk register or 
issue a refusal notice in accordance with section 17 of the FOIA. 


Section 40 - personal information 


21. 


22. 


Section 40(2) of the FOIA states that information is exempt from 
disclosure if it constitutes the personal data of a third party and its 
disclosure under the FOIA would breach any of the data protection 
principles or section 10 of the Data Protection Act 1998 (DPA). 


In this case the council has argued that the withheld information 
comprises the names of junior council staff and non-council employees. 
The council confirmed that the employees are junior officers, i.e., those 
below Assistant Director level and stated that it considers that disclosure 
of the information would be unfair and would breach the first data 
protection principle. 


Is the requested information personal data? 


23. 


In order to rely on the exemption provided by section 40, the 
information being requested must constitute personal data as defined by 
section 1 of the DPA. It defines personal information as data which 
relates to a living individual who can be identified: 


e from that data, 


e or from that data and other information which is in the possession 
of, or is likely to come into the possession of, the data controller. 
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Having viewed the withheld information, which consists of individuals’ 
names, the Commissioner accepts that the requested information 
constitutes personal data, within the definition at section 1(1) of the 
DPA. 


Would disclosure breach one of the data protection principles? 


25. 


Having accepted that the information requested constitutes the personal 
data of a living individual other than the applicant, the Commissioner 
must next consider whether disclosure would breach the first data 
protection principle. The first data protection principle has two 
components: 


e personal data shall be processed fairly and lawfully; and 
e personal data shall not be processed unless at least one of the 
conditions in DPA schedule 2 is met. 


Would disclosure be fair? 


26. 


In considering whether disclosure of the information requested would 
comply with the first data protection principle, the Commissioner has 
first considered whether disclosure would be fair. In assessing fairness, 
the Commissioner has considered the reasonable expectations of the 
individuals concerned, the nature of those expectations and the 
consequences of disclosure to the individual. He has then balanced 
against these the general principles of accountability, transparency as 
well as any legitimate interests which arise from the specific 
circumstances of the case. 


Expectations of the individuals concerned 


27. 


28. 


29. 


The Commissioner has considered the reasonable expectations of the 
individuals in terms of what would happen to their personal data. These 
expectations can be shaped by factors such as an individual’s general 
expectation of privacy and also the purpose for which they provided 
their personal data. 


The council explained that its Redaction Policy defines when to withhold 
names in response to information requests. This states that names, 
contact details and job titles or other information which could identify 
junior officers should be redacted. The council has defined junior 
officers as persons below assistant director level. The council clarified 
that its policy was developed in line with ICO guidance and the policy 
has been consistently applied to all information requests. 


The Commissioner has referred to his own guidance which states: 
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31. 


32. 
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“It is reasonable to expect that a public authority would disclose more 
information relating to senior employees than more junior ones. Senior 
employees should expect their posts to carry a greater level of 
accountability, since they are likely to be responsible for major policy 
decisions and the expenditure of public funds. ”? 


The Commissioner’s guidance does go on to qualify that the terms 
‘senior’ and ‘junior’ are relative and that it is not possible to set an 
absolute level across the public sector below which personal information 
will not be released. The Commissioner considers that it is always 
necessary to consider the nature of the information and the 
responsibilities of the employees in question when considering whether 
it would be fair to disclose personal data. 


The council has acknowledged that its employees are aware that if their 
personal data is relevant to a request it may be subject to disclosure. 
The council explained that its redaction policy does provide for instances 
where the names of employees would be disclosed in response to 
requests for information. However, in this instance, given the junior 
level of the employees and the fact that their roles are not public-facing, 
the council decided that it would not be fair to disclose their personal 
data in response to the request. 


In relation to non-council employees, the council confirmed that it had 
sought their consent for the disclosure of their names. This consent was 
refused. 


When considering what information third parties should expect to have 
disclosed about them, the Commissioner considers that a distinction 
should be drawn as to whether the information relates to the third 
party’s public or private life. However, although the personal data of 
council employees in this context does relate to their public life, the 
Commissioner accepts that, as a result of the consistent use of the 
redaction policy, the employees identified in the withheld information 
would have a reasonable expectation that their names would not be 
disclosed. Similarly, in relation to non-council employees, an explicit 
refusal of consent heightens the probability of disclosure being contrary 
to expectations. 


3 ICO guidance is published here: 
http: 


www.ico.gov.uk/for organisations/quidance_ index/~/media/documents/library/Enviro 


nmental_info_reg/Practical_application/section 40 requests _for_ personal _data_about_empl 
oyees.ashx 
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Consequences of disclosure 


34. 


In light of the reasonable expectations of the individuals concerned, the 
Commissioner is satisfied that release of the withheld information would 
be an intrusion of privacy and could potentially cause unnecessary and 
unjustified distress to the individuals in this case. 


General principles of accountability and transparency 


35. 


36. 


37. 


38. 


Notwithstanding a data subject’s reasonable expectations or any 
damage or distress caused to them by disclosure, it may still be fair to 
disclose the requested information if there is a more compelling public 
interest in disclosure. The complainant has argued that there is a public 
interest in knowing who is carrying out the work which will result in 
significant effects on public services and which involves considerable 
public expenditure. 


The council has argued in its submissions to the Commissioner that 
disclosure of the names of data subjects identified in the withheld 
information would not add anything to the public understanding of the 
substantive issue. 


The council has further argued that the One Barnet is a highly sensitive 
issue and that public opposition to the outsourcing puts council staff 
working on the project at higher risk of abuse and harassment. The 
council has stated that it is, therefore, particularly cautious about 
disclosing the names of these officers in order to reduce the likelihood of 
them being identified by members of the public. 


The council provided the Commissioner with an example of a specific 
‘threat’ made to persons working on the One Barnet Project and 
highlighted its duty of care to its employees. It stated that it has 
reasonable evidence to believe that the disclosure of the withheld 
information would result in identification of individuals working on the 
One Barnet Project and would result in them being targeted, abused and 
harassed. 


In reaching his decision in this case, the Commissioner has set the 
public interest in disclosure against the data subjects’ reasonable 
expectations that their names would not be disclosed in response to 
requests for information and the evidence which points to the likelihood 
of the data subjects becoming the focus of harassment. 
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39. In considering the above, the Commissioner has also referred to the 
parallels with a previous decision he has made which identifies an 
equivalent scenario’. 


40. Having considered the relevant facts the Commissioner has concluded 
that the withheld information is personal data and that disclosure would 
breach the first data protection principle as it would be unfair to the 
individuals concerned. 


41. As the Commissioner has determined that it would be unfair to disclose 
the requested information, it has not been necessary to go on to 
consider whether disclosure is lawful or whether one of the conditions in 
Schedule 2 of the DPA is met. The Commissioner therefore upholds the 
Council’s application of the exemption provided at section 40(2) of the 
FOIA. 


Section 43 - commercial interests 


42. Section 43(2) of the FOIA provides an exemption from disclosure of 
information which would or would be likely to prejudice the commercial 
interests of any person (including the public authority holding it). This is 
a qualified exemption and is, therefore, subject to the public interest 
test. 


43. The term ‘commercial interests’ is not defined in the FOIA, however, the 
Commissioner has considered his awareness guidance on the application 
of section 43. This comments that: 


“„a commercial interest relates to a person’s ability to participate 
competitively in a commercial activity, i.e. the purchase and sale of 
goods or services.” 


44. As this information relates to the council’s ability to negotiate contracts 
in respect of the delivery of public services, the Commissioner has 
concluded that it falls within the scope of the exemption. 


4 DN issued to the Home Office (ICO reference: FS50401773) in February 2012. Published 
on the ICO website here: 


http: //www.ico.gov.uk/~/media/documents/ decisionnotices/2012/fs_50401773.ashx 


> See here: 


om_of_Information/Detailed_specialist_quides/AWARENESS GUIDANCE 5 V3 07 03 08.as 
hx 
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Having concluded that the withheld information falls within the scope of 
the exemption the Commissioner has gone onto consider the prejudice 
which disclosure would cause and the relevant party or parties which 
would be affected. 


Whose commercial interests and the likelihood of prejudice 


46. 


47. 


Section 43(2) consists of 2 limbs which clarify the probability of the 
prejudice arising from disclosure occurring. The Commissioner 
considers that “likely to prejudice” means that the possibility of 
prejudice should be real and significant, and certainly more than 
hypothetical or remote. “Would prejudice” places a much stronger 
evidential burden on the public authority and must be at least more 
probable than not. 


The council has stated that, in withholding the information it considers 
that disclosure of the information would be likely to prejudice its own 
commercial interests. 


The nature of the prejudice 


48. 


49. 


The council confirmed that, at the time of the request, it was involved in 
contract negotiation with a number of potential outsourcing partners. 


The council has stated that disclosure of the information would reveal 
the council’s assessment of its own risks and weaknesses in the context 
of active negotiations with third parties. According to the argument 
proposed, this would be likely to result in prejudice to the council’s 
ability to achieve best value for money contracts with the most 
favourable terms and conditions. Before considering the council’s 
arguments in this regard, the Commissioner has first considered another 
argument submitted by the council, namely that the nature of the risk 
register is such that it is open to misinterpretation. 


Potential for the information to be misinterpreted 


50. 


51, 


The council has argued that there is potential for disclosure of the 
information to cause harm because the risk register document does not 
contextualise the risks. 


The council explained that the purpose of the register is to document all 
risks that have been identified and recorded. What it does not do is 
indicate the likelihood of the risks occurring. Whilst the document 
identifies risks with a high risk rating, this is only in relation to the 
perceived severity of the effects of the risk occurring. It is possible, 
therefore, that an issue with a high risk rating may carry a very low 
probability of it actually occurring. 
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The council has argued that the disclosure of the information might lead 
to a misperception which in turn might provide bidders with an incentive 
to treat the risks as if they were expected to occur and use the 
associated severity rating as a tool to improve their bargaining position. 
This would directly and negatively impact the council’s negotiations and, 
by extension, its commercial interests. 


In considering this argument, the Commissioner notes that the FOIA 
only provides a right to information already held by authorities and that 
there is no requirement for this to be accurate, complete, up to date or 
easily comprehensible. 


In considering this point, the Commissioner has referred to the 
Information Tribunal decision in the case of the Home Office 
(EA/2008/0027 - 15 August 2008). In this case the complainant asked 
for the number of work permits obtained in 2005 and 2006, the Home 
Office argued that the information produced from its database might be 
inaccurate as the details are not always entered consistently or correctly 
by employees. In addition, the public authority argued that it could not 
be said that the information extracted from the database would be 
completely accurate as the search terms used may pull up records which 
are irrelevant to the request. At paragraph 15 the Tribunal found that: 


“if the records are faulty or inadequate and the information therefore 
turns out to be inaccurate that is irrelevant: the right under the Act is to 


information which is held, not information which is accurate”®. 


In the Commissioner’s view, where authorities have concerns about the 
accuracy of information or the potential for misinterpretation, rather 
than withholding the information, one option is to provide an 
explanation or other background information to set the disclosure in 
context. 


The Commissioner notes that, in a case involving the Scotland Office 
(ICO reference: FS50142678 - 17 March 2008), it was argued that as 
much of the information contained within the requested reports was out 
of date and potentially inaccurate; the disclosure of the information 
could be misleading. The Commissioner commented at paragraph 44 of 
his decision notice that “..the accuracy of the data may be questionable 


6 See: 
http: 


www.informationtribunal.gov.uk/DBFiles/Decision/i203/homeOffice webDecision 15A 


ug08. pdf 
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however; the Scotland Office can place this in context by explaining this 


to the complainant when disclosing the information”’. 


Whilst he accepts that there is potential for the withheld information to 
be misinterpreted, the Commissioner does not accept that this in itself is 
a valid argument for withholding information. In the particular context 
of the council’s application of section 43(2), he also does not consider 
that the council has demonstrated exactly how, with reference to the 
specific withheld information, the possibility of the information being 
misread would be likely to result in prejudice to its commercial interests 
and what precise form this prejudice would take. Having reached this 
conclusion the Commissioner has gone on to consider the council’s other 
arguments in support of the engagement of the exemption. 


Negotiation position, bargaining strengths and ability to achieve value for 
money 


58. 


59. 


60. 


The council has confirmed that, at the time the request was received, 
negotiations with potential contractors were in train. Disclosure of the 
withheld information whilst these negotiations were ongoing would, 
according to the argument presented, expose the council’s perceived 
weaknesses and provide third parties involved in negotiations with an 
advantage which would undermine the council’s position. This, in turn, 
would be likely prejudice the council’s ability to obtain best value for 
money contracts. 


The Commissioner’s guidance and many previous decision notices have 
accepted the general principles that information relating to a commercial 
activity is more likely to be sensitive when the activity in question, in 
this instance, contractual negotiations, is live’. 


However, the Commissioner considers that arguments which identify 

this generic scenario alone are not sufficient to engage the exemption. 
The Commissioner considers that the prejudice test is not a weak test, 
and a public authority must be able to point to prejudice which is “real, 


7 Published on the ICO website here: 


http: //www.ico.gov.uk/~/media/documents/decisionnotices/2008/FS_50142678.ashx 


8 See, for example, this decision notice relating to the London Borough of Newham: 


http: //www.ico.gov.uk/~/media/documents/decisionnotices/2012/fs_50431421.ashx 
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actual or of substance” and to show some causal link between the 
potential disclosure of specific withheld information and the prejudice. 


The Commissioner considers that an evidential burden rests with public 
authorities to be able to show that some causal relationship exists 
between the potential disclosure and the prejudice and the prejudice is, 
real, actual or of substance. In the Commissioner’s view, if a public 
authority is unable to discharge this burden satisfactorily, reliance on 
‘prejudice’ should be rejected. 


The Commissioner notes that the One Barnet programme involves the 
potential expenditure of £1 billion of public money in contracts for the 
provision of public services. 


Given the sum of money involved and the accompanying transformation 
of the way in which public services are delivered, the Commissioner 
considers that the council should expect that the programme would be 
subjected to a high level of scrutiny. This is essentially a public interest 
observation which the Commissioner accepts cannot be transposed into 
a consideration of whether the exemption is engaged. However, the 
Commissioner considers that arguments in relation to the likelihood of 
prejudice occurring should be specific to the information in question and 
proportionate to the facts of any case. 


In this case, the council has argued that disclosure of the information 
would be likely to result in prejudice to its contractual negotiations. 
However, the Commissioner considers that the council has failed to 
identify precisely what form the prejudice would take and failed to clarify 
how this would be caused by the disclosure of the specific withheld 
information. 


Having considered the council’s submissions, the Commissioner finds 
that no reference has been made to the specific content of the withheld 
information: the council has simply stated that disclosure would be likely 
to have an effect on negotiations. The Commissioner considers that the 
fact that a risk register will identify potential weaknesses within an 
authority does not inevitably lead to a conclusion that its disclosure will 
have an impact on commercial interests. In failing to explain precisely 
how the disclosure of those specific, withheld elements of the register 
would be likely to result in prejudice, the Commissioner considers that 
the council has failed to demonstrate a necessary causal link. 


In light of this failure, whilst he has not reached a conclusion in this 
regard, the Commissioner has concerns that the council may have 
applied the exemption in blanket manner without proper consideration 
for the specific information which is being withheld. 
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67. In cases where an authority has failed to explain the nature of an 
implied prejudice and failed to demonstrate the causal link between any 
such prejudice and the disclosure of information, the Commissioner is 
not obliged to generate relevant arguments on an authority’s behalf. 


68. In this instance, the Commissioner considers that the council has failed 
to explain the nature of the prejudice which would be likely to result 
from disclosure of the requested information. He has, therefore, 
concluded that the council has failed to demonstrate that the exemption 
is engaged. As he does not consider that the exemption applies, the 
Commissioner has not gone on to consider the public interest 
arguments. 


Other matters 


69. Although they do not form part of this notice the Commissioner would 
like to note the following matters of concern. 


70. The code of practice issued under section 45 of the FOIA (the “code”) 
recommends that complaints procedures provided by public authorities 
in relation to requests for information (‘internal reviews’) should 
encourage a “...prompt determination of the complaint. ”? 


71. The Commissioner’s guidance interprets promptness as a standard 
target of 20 working days for the completion of internal reviews’°. 


72. In this case, the Commissioner notes that the council’s internal review 
took over 150 working days to complete - well in excess of the 
recommended timescales. In its future handling of internal reviews the 
Commissioner expects that the council will have regard for the 
recommendations of the code and his own guidance and will ensure that 
responses are issued promptly. 


? Paragraph 39 of the code, published online here: 
http://www. justice. gov.uk/downloads/information-access-rights/foi/foi-section45-code- of- 


practice. pdf 
10 The ICO guidance is published here: 
http: //www.ico.gov.uk/upload/documents/library/freedom_ of information/practical applicati 


on/internal% 20reviewsv1. pdf 
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Right of appeal 


73. Either party has the right to appeal against this decision notice to the 
First-tier Tribunal (Information Rights). Information about the appeals 
process may be obtained from: 


First-tier Tribunal (Information Rights) 
GRC & GRP Tribunals, 

PO Box 9300, 

LEICESTER, 

LE1 8D} 


Tel: 0300 1234504 
Fax: 0116 249 4253 
Email: informationtribunal@hmcts.gsi.gov.uk 


Website: www. justice. gov.uk/guidance/courts-and- 
tribunals/tribunals/information-rights/index.htm 


74. If you wish to appeal against a decision notice, you can obtain 
information on how to appeal along with the relevant forms from the 
Information Tribunal website. 


75. Any Notice of Appeal should be served on the Tribunal within 28 
(calendar) days of the date on which this decision notice is sent. 


Signed issivdonsesnsusdiswadcnicainenis senna nena panana 


Andrew White 

Group Manager 

Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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